130 Posts

June 12th, 2015 10:00

Hello Chris_S,

Thank you for your question! Peter_Sero is correct here, there is no corresponding RBAC privilege to the commands you mentioned. The workaround he mentions will be sufficient to run these commands. In my testing, I am using a local user, but you can accomplish this with a domain user should you need to:

cluster-1# isi_visudo

## Sudoers override file.

##

## This file overrides the default configuration for sudo as provided by

## Isilon. The defaults can be found at /etc/mcp/templates/sudoers. Do not

## edit /etc/mcp/templates/sudoers.

##

## To add additional command permissions, enter the appropriate configuration

## lines below. To remove a command provided by default, enter a negation line

## below.

##

## Example:

##

## To prevent admin from running SyncIQ, uncomment the line below:

## admin ALL=(ALL) !/usr/bin/isi sync*

##

ktjoh ALL=(ALL) ISI_SUPPORT

~

/etc/mcp/override/sudoers.tmp: 16 lines, 538 characters.

isi_visudo: Warning: Cmnd_Alias `ISI_SUPPORT' referenced but not defined

cluster-1# su ktjoh

cluster-1% isi_hw_status

zsh: permission denied: isi_hw_status

cluster-1% sudo isi_hw_status

We trust you have received the usual lecture from the local System

Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.

    #2) Think before you type.

    #3) With great power comes great responsibility.

Password:

  SerNo: SX200-301113-0027

Config: 400-0034-01

FamCode: X

ChsCode: 2U

GenCode: 00

Product: X200-2U-Single-24GB-4x1GE-5632GB-200GB SSD

Comps:  Chassis CPU     Motherboard     NVRam   FlashDrive      Disk_Controller Disk_Expander   Power_Supplies

Chassis: ISI12V2 (Isilon 12-Bay(V2) Chassis)

4 Operator

 • 

1.2K Posts

June 3rd, 2015 03:00

The ISI_SUPPORT command set is only relevant within the sudoers file,

and cannot be linked to any RBAC roles. As there is no corresponding "ISI_PRIV_SUPPORT"

privilege; and one cannot create new RBAC privileges...

Seems you have to stick with the plain sudoers mechanism:

use isi_visudo to add

thisusername     ALL=(ALL) NOPASSWD: ISI_SUPPORT

hth

-- Peter

No Events found!

Top